# CVE-2026-96396: Affinity by Canva integer overflow in QuickLook thumbnail generation

Source: https://junglewise.ai/threats/cve-2026-96396-the-affinity-by-canva-application-for-macos-before-3-3-1-october  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-96396 · Severity: medium · CVSS 4.9 · Published 2026-10-09

Affinity by Canva is a design application for macOS. When a user previews or views a crafted Affinity document file in Finder, the application's thumbnail and preview feature miscalculates buffer sizes, leading to memory corruption. An attacker can crash the preview extension, though data theft or code execution is unlikely with the reported low attack complexity.

Technologies: [Canva Affinity](https://junglewise.ai/threats/technologies/affinity). Vendors: [Canva](https://junglewise.ai/threats/vendors/canva).

## Quick answers

**Is CVE-2026-96396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96396 being exploited in the wild.

**How severe is CVE-2026-96396?** Medium severity, with a CVSS score of 4.9, published 9 October 2026.

**Which products and versions are affected?** Canva Affinity before 3.3.1 (October 2026 release).

**Is there a fix for CVE-2026-96396?** Yes: fixed in 3.3.1 (October 2026 release). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96396 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-96396?** Check whether you run Canva Affinity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.1 (October 2026 release)

## Technical details

An integer overflow in image buffer size calculation within the QuickLook preview extension leads to a heap-based buffer overflow when processing Affinity document files. The vulnerability is triggered when a user displays or previews a maliciously crafted document in Finder, requiring no user authentication or special privilege beyond the ability to view files. The impact is denial of service via preview extension crash; memory corruption may occur but exploitation for code execution is not indicated.

## Affected products

- Canva Affinity before 3.3.1 (October 2026 release)

## Timeline

- 2026-10-09: disclosed

## References

- [https://trust.canva.com/?tcuUid=1998378a-9134-47e9-b761-7a49d5fd6bfb](https://trust.canva.com/?tcuUid=1998378a-9134-47e9-b761-7a49d5fd6bfb)

## Related threats

- [Affinity by Canva out-of-bounds read in raster image parsing](https://junglewise.ai/threats/cve-2026-103220-the-affinity-by-canva-application-before-3-3-1-october-2026)
- [Affinity by Canva stack buffer overflow in document parsing](https://junglewise.ai/threats/cve-2026-81546-affinity-by-canva-stack-buffer-overflow-in-document-parsing)